WhatsApp phishing attack uses fake business docs to hack PCs
Short summary
Attackers hijack WhatsApp accounts to send obfuscated VBScript files named as business or financial documents. When opened, the script disables UAC, downloads ManageEngine Endpoint Central, and connects the PC to attacker-controlled servers for remote administration. The campaign hits users in over a dozen countries, though how WhatsApp accounts are first compromised remains unclear.
- Attackers are hijacking WhatsApp accounts to send malicious VBScript files disguised as invoices or financial reports, hitting users across 11+ countries.
- Opening the file disables UAC, then silently installs the legitimate ManageEngine Endpoint Central tool to give attackers full remote control of the PC.
- Code artifacts point to Chinese-language origins and overlap with ValleyRAT/Gh0st RAT infrastructure, though no group has been formally attributed.
- It's still unknown how the attackers are initially compromising victims' WhatsApp accounts.
Full summary
A wave of phishing messages on WhatsApp is pushing VBScript files disguised as business or financial documents. Attackers hijack legitimate contacts’ accounts, then send out files named things like “invoice_2023.vbs” or “financial_report.vbs” in the recipient’s local language. Kaspersky telemetry shows this campaign active in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam and Malaysia.
Opening the VBS kicks off a multi-stage infection. The script pulls down two more scripts, tweaks Windows Registry to turn off User Account Control, then retrieves and unpacks a ZIP containing the ManageEngine Endpoint Central client. That software installs silently and phones home to attacker-controlled servers, handing over full remote administration on the victim’s PC.
Researchers spotted Chinese-language artifacts in the code and some overlap with infrastructure linked to ValleyRAT and Gh0st RAT, but they stopped short of naming a culprit. How the attackers first broke into WhatsApp accounts remains a mystery.
If you use WhatsApp Web or Desktop, treat unexpected files—even from friends—with skepticism. Verify any attachment through a separate channel and scan everything with updated antivirus or endpoint protection before you run it.